diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
index b809e2b98..aa03df007 100644
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -910,14 +910,14 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
         e->buf.len = code->size;
 
         if (code->uri) {
-            if (rc && (r->quoted_uri || r->plus_in_uri)) {
+            if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) {
                 e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
                                                  NGX_ESCAPE_ARGS);
             }
         }
 
-        for (n = 1; n < (ngx_uint_t) rc; n++) {
-            e->buf.len += r->captures[2 * n + 1] - r->captures[2 * n];
+        for (n = 2; n < r->ncaptures; n += 2) {
+            e->buf.len += r->captures[n + 1] - r->captures[n];
         }
 
     } else {
diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 633b31084..0289a64ac 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -1810,7 +1810,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
 #endif
     }
 
-    r->ncaptures = len;
+    r->ncaptures = rc * 2;
     r->captures_data = s->data;
 
     return NGX_OK;